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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )KI Responsive to communication(s) filed on 23 October 2005 . 
2a )^ This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-30 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |EI Claim(s) 1-30 is/are rejected. 

7) 0 Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) Q The specification is objected to by the Examiner. 

10) ^ The drawing(s) filed on 03 October 2005 is/are: a)^ accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
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20 Certified copies of the priority documents have been received in Application No. . 
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application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1 . Currently pending claims are 1 - 30. 

Response to Arguments 

2. Applicant's arguments with respect to the subject matter of the instant claims have been 
fully considered but are not persuasive with the following rationale. 

• As per claim 1 and 19, Applicant asserts "Epstein repeatedly stresses that the 
query is intended to be anonymous and thus neither the user random number nor the user 
public key identify the user as alleged by the Office Action" (Remarks: Page 16 / 1 st Para). 
Examiner respectfully disagrees because (i) an anonymous data entity with security key 
information attached, as taught by Epstein, is merely meant that the identity is hidden which is 
different from unknown, as alleged by Applicant and (ii) accordingly, any data entity that is 
sufficient to uniquely distinct a given user / provider from others can thus constitutes an identity 
of a corresponding user / provider such as a user's private / public key and a provider's 
symmetric key information. 

• Accordingly, as per claim 1 and 19's argument (a) and (b), please refer to this 
Final office action as set forth below for detail comments (Remarks: Page 14 / 2 nd Para and 
Page 15 /3rd Para). 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 
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A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

3. Claims 1 - 30 are rejected under 35 U.S.C. 102(b) as being anticipated by Epstein (U.S. 
Patent 6,023,510). 

As per claim 1, 12, 19, 22 and 28 - 30, Epstein teaches a method for provision of 
access for a data requesting entity (Epstein: Column 3 Line 36 - 51 and Column 2 Line 29 - 
30: a user terminal (or a public terminal) is qualified as a data requesting entity) to data related 
to a principal (Epstein: Column 3 Line 43 - 51 / Line 64: the user information (e.g. user public 
key, random number and etc.) included in the access request query package / message, which 
can uniquely distinct a given user from others is qualified as a principal), comprising the 
following steps: 

creating an access granting ticket (Epstein: Column 3 Line 36-51, Column 5 Line 62 
- 67 and Column 7 Line 1 - 34 & Figure 1 : (a) please note an access granting ticket as recited 
in the claim can be either the ticket sent from the data requesting entity (as recited in Claim 
. 1.(b)-3" '-bullet or the ticket sent to the data requesting entity (as recited in Claim . 1.(b)-2' vj - 
builet) and accordingly, Exam iner notes ^ sent from the data 

requesting entity is equivalent to the data query package (QP) whil e an access granting ticket 
when sent to the data requesting entity is equivalent to the data response package (RP), as 
taught by Epstein, (b) a "package / ticket" to jespgndJ__grant.!P response to the corresponding 
request /query ticket to allow the user to access information provid er's data INFO is Qualified as 
an access granting ticket, which is based upon the correct user random number, user public key 
as well as correct providers sy mmetric key jnfgrmat[on_sg as to enable the user to decrypt and 
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access the provided data content and (c) a "package / ticket" to request / query the access to 
information provider's data INFO also constitutes an access graningt ticket which is based upon 
the correct user random number and user public key and etc. so as to enable the decryption 
and to allow the user to access the provided data content ) comprising: 

(a) an access specification specifying a permission for an access to data related 
to the principal, said data being available at a data providing entity (Epstein: Column 3 
Line 36 - 51 / Line 64 and Column 7 Line 1 - 34 & Figure 1: the user information (e.g. user 
public key, user random number, H(Q) and etc.) included in the access request query package / 
message is qualified as an access specification which determines / specifies whether or not the 
access permission can be granted by the data providing entity to allow the valid user to access 
the provided data content), 

(b) a principal identifier representing the principal towards the data providing 
entity (Epstein: Column 3 Line 43 - 51 / Line 64: (a) any transformed random number / public 
key which can uniquely distinct a given user from others is qualified as part of "principle 
identifier" of the user and (b) the user information (e.g. user public key, user random number 
and etc.) included in the access request query package / message is qualified as a principal); 

encrypting the access granting ticket with an encryption key of the data providing 
entity (Epstein: Column 7 Line 28 - 30, Column 7 Line 6-9 and Column 3 Line 50 - 51 & 
Figure 2 / Element 50: * i ke> SymK-info is generated by an information provider, 
which s« used to eo&rypt the - expense / granting package RP formulated by the provider). 

communicating to the data requesting entity the encrypted access granting ticket 
accompanied by an identifier of the data providing entity (Epstein: Epstein: Column 7 Line 
28 - 30, Column 7 Line 6-9, Column 3 Line 36 - 42 / Line 50 - 51 and Column 2 Line 29 - 
30& Figure 2 / Element 50: (a) a user terminal or a public terminal constitutes a data requesting 
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entity, (b) - % \ % ^ ; - \ , 8 " v - , ^ ^ N ^ x 

o encrypt the s any data 

entity that is sufficient to uniquely distinct a given provider from others can thus constitutes an 
identity of a corresponding provider such as a provider's symmetric key information), 

communicating from the data requesting entity to the data providing entity a 
request comprising the encrypted access granting ticket (Epstein: Column 3 Line 41 and 
Column 2 Line 29 - 30: (a) Examiner notes the requested access granting ticket is a request 
sent by the user for granting the access to provider's data and thus an encrypted access 
granting ticket is also qualified as a data access query package / message and (b) see the 
same rejection rational for the first claim limitation), 

decrypting the encrypted access granting ticket with a decryption key of the data 
providing entity corresponding to the encryption key (Epstein: Column 3 Line 50-51: see 
the same rejection rational for the first claim limitation), 

providing to the data requesting entity access to data related to the principal 
identifier according to the access specification (Epstein: Column 4 Line 6-11 and Column 
7 Line 21 - 30: data is downloaded to the valid user terminal). 

As per claim 2, 13 and 23, Epstein teaches the encrypted access granting ticket 
comprises or is accompanied by verification information and access is provided based on an 
analysis of the verification information (Epstein: Column 3 Line 36 - 42 / Line 50-51: the 
encrypted access granting ticket comprises verification information as presented above). 

As per claim 3 and 24, Epstein teaches the request to the data providing entity 
comprises a specification for requested data related to the principal and access is provided 
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according to a matching of the access specification and the requested data (Epstein: Column 6 
Line 56 - 64). 

As per claim 4, 14 and 21, Epstein teaches the access granting ticket is created based 
on a data storage correlating at least two items of a group comprising the identifier of the data 
providing entity, the data related to the principal available at the data providing entity, the 
principal identifier, the encryption key, and the access specification (Epstein: Column 3 Line 36 
-42 /Line 50 -51). 

As per claim 5 and 15, Epstein teaches an indication for the access specification is 
entered into a principal entity to create the access granting ticket (Epstein: Column 3 Line 36 - 
37: the user information is entered and thus available at the user terminal device). 

As per claim 6, 16 and 25, Epstein teaches the access granting ticket further comprises 
security information and access is provided based on an analysis of the security information 
(Epstein: Column 3 Line 36 - 42 / Line 50 - 51). 

As per claim 7, 8 and 17, Epstein teaches the encrypted access granting ticket is 
accompanied by public information (Epstein: Column 3 Line 36 - 42 / Line 50 - 51 : the 
encrypted access granting ticket indeed comprises content server's public key information ). 

As per claim 9 and 26, Epstein teaches the decryption is based on an analysis of the 
public information (Epstein: Column 3 Line 36 - 42 / Line 50 - 51 : the decryption of the access 
granting ticket is based upon content server's public key information ). 
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As per claim 10 and 27, Epstein teaches the data to which access is provided to is 
transferred to the data requesting entity (Epstein: Column 4 Line 6-11 and Column 7 Line 21 - 
30: data is downloaded to the user terminal). 

Conclusion 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as 
set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing date 
of this final action. 

Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to LONGBIT CHAI whose telephone number is (571)272-3788. The 
examiner can normally be reached on Monday-Friday 9:00am-5:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, William R. Korzuch can be reached on 571-272-7589. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you 
would like assistance from a USPTO Customer Service Representative or access to the 
automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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